MySQL query no results - php

I want echo my DB results from Session but i get no results or errors:
$_SESSION['username'];
$link = mysqli_connect("$myHost", "$myUser", "$myPass", "$myDB");
// Check connection
if($link === false){
die("ERROR: Could not connect. " . mysqli_connect_error());
}
$username = mysqli_real_escape_string($link, $_SESSION['username']);
$sql = "SELECT * FROM users where username = $username";
$result = mysqli_query($link, $sql);
echo $result;
Anyone know why not? Session works.
Thanks

You should change your query, like this:
$sql = "SELECT user FROM yourtablename WHERE username = $username"
Where "user" is what you want to SELECT if you want to select all data, you can use "*", yourtablename is table name of table you want to select.
After your edits, your code should look like
$_SESSION['username'];
$link = mysqli_connect("$myHost", "$myUser", "$myPass", "$myDB");
// Check connection
if($link === false){
die("ERROR: Could not connect. " . mysqli_connect_error());
}
$username = mysqli_real_escape_string($link, $_SESSION['username']);
$sql = "SELECT * FROM users where username = $username";
if ($result = $link->query($sql)) {
while ($row = $result->fetch_row()) {
var_dump($row);
}
$result->close();
}
More info here
Notice: mysqli_real_escape_string it's not very security. A better option to protect against SQL injections is using prepared statements, more info here

Related

How to count number of rows from a table using PHP

I am trying to get the count of number of rows from Vulnerability table based on the vulnerability and threat entered. But always i get a value None in place of vulnerability count.
$link = mysqli_connect("localhost", "root", "sharmi#08", "MySQL56");
// Check connection
if ($link === false) {
die("ERROR: Could not connect. " . mysqli_connect_error());
}
// Escape user inputs for security
$Vulnerability = mysqli_real_escape_string($link, $_POST['Vulnerability']);
$Threat = mysqli_real_escape_string($link, $_POST['Threat']);
/*$P_Vulnerability = mysqli_real_escape_string($link, $_POST['P_Vulnerability']);*/
/*$P_Threat = mysqli_real_escape_string($link, $_POST['P_Threat']);*/
$Threat_count = mysqli_real_escape_string($link, $_POST['Threat_count']);
$table = mysqli_real_escape_string($link, $_POST['Vul']);
// attempt insert query execution
$sql = "INSERT INTO vuln_threat(Vulnerability, Threat) VALUES ('$Vulnerability', '$Threat') ";
$Vulnerability_count = mysqli("Select count(*) from vuln_threat");
$sql = "UPDATE vuln_threat SET Vulnerability_Count='$Vulnerability_count',Threat_Count='1' WHERE Vulnerability='".$Vulnerability."' AND Threat='".$Threat."'";
//$select_result = mysqli_query($query);
if ( mysqli_query($link, $sql, $query)) {
echo "New Records added successfully." ;
} else {
echo "Please add records." ;
}
// close connection
mysqli_close($link);
mysqli_query accepts only predefined constants as the 3rd parameter when used in a procedural fashion.
http://php.net/manual/en/mysqli.query.php

mysql to check if value is more than 0

Here's my code. Actually it run without error but it always enter the first condition even though the value in mysql is more than 0 say for example is 10.
<?php
session_start();
$loginuser = $_SESSION['result'];
$con=mysqli_connect("localhost","root","","leavecalendar");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$sql="SELECT leavecount from employee WHERE username = $loginuser[username]";
$resource = mysql_query($sql);
if ($resource == 0) {
echo "ajsdjsdasjd"; <----always enters here
}
else
{
header("insert.php");
}
mysqli_close($con);
?>
First off, you are mixing api's. Dont mix mysqli_* and mysql_*. Just stick with mysqli_*.
$con = mysqli_connect("localhost","root","","leavecalendar"); // mysqli
$resource = mysql_query($sql); // mysql
Second, since you are using mysqli_* now, just use prepared statements.
$sql="SELECT leavecount from employee WHERE username = $loginuser[username]";
Third, dont compare the result set to zero, instead, check how many rows did the result return.
$resource = mysqli_query($con, $sql);
if ($resource == 0) {
Consider this example:
session_start();
if(isset($_SESSION['result'])) {
$mysqli = mysqli_connect("localhost","root","","leavecalendar");
$loginuser = $_SESSION['result'];
$stmt = $mysqli->prepare("SELECT leavecount from employee WHERE username = ?");
$stmt->bind_param("s", $loginuser);
$stmt->execute();
if($stmt->num_rows > 0) {
// if it has results
header("Location: insert.php");
} else {
// if it has NO results
}
}
Problems
1) You can not use
mysql_query($query)
For mysqli
2)
"SELECT leavecount from employee WHERE username = $loginuser[username]"
The username should be single quoted or double quoted.
For ex: "SELECT leavecount from employee WHERE username = 'dineshrawat'";
Solution
<?php
session_start();
$loginuser = $_SESSION['result'];
$con=mysqli_connect("localhost","root","","leavecalendar");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$sql="SELECT leavecount from employee WHERE username = $loginuser[username]";
$resource = mysqli_query($con, $sql);
if ($resource == 0) { // If there is no record in result set
echo "No record found";
}
else
{
header("insert.php");
}
mysqli_close($con);
?>

Updating something in a database with a php file

Hello iam working on a game on unity3d and i have a login/register system that have a database so i have these level thing i want to save in to the users database, just for testing i have created this php file:
<?PHP
$username = $_POST['username'];
$pass = $_POST['password'];
$con = mysql_connect("host","user","password") or ("Cannot connect!" . mysql_error());
if (!$con)
die('Could not connect: ' . mysql_error());
mysql_select_db("database" , $con) or die ("could not load the database" . mysql_error());
$check = mysql_query("SELECT * FROM users WHERE `username`='".$username."'");
$numrows = mysql_num_rows($check);
if($username == null)
{
die ("You are not allowed to access this site! \n");
}
else
{
if ($numrows == 0)
{
die ("Username does not exist \n");
}
else
{
$pass = md5($pass);
while($row = mysql_fetch_assoc($check))
{
if ($pass == $row['pass'])
{
die("saved-SUCCESS");
$sqlUpdate = "UPDATE users SET level='2' WHERE id='1'";
//$SQL = "UPDATE users SET level = '2' WHERE id = 1";
}
else
die("Password is wrong \n");
}
}
}
?>
it does says "saved-SUCCESS" in unity3d so that means this:
$sqlUpdate = "UPDATE users SET level='2' WHERE id='1'";
should work but it doesent
also i have tryed this:
$SQL = "UPDATE users SET level = '2' WHERE id = 1";
but it doesent work either
here is a picture of the user with id 1:
http://i.imgur.com/NZslFBN.png
and here is a picture of the structur tab:
http://i.imgur.com/ZN6PyW1.png
and yes my table is named users :)
You are not executing your second query but only printing saved-SUCCES
$sqlUpdate = "UPDATE users SET level='Rune' WHERE id='1'";
mysql_query($sqlUpdate);
die("saved-SUCCESS"); //then exit.
As side note i would advise thta your code is highly vulnerable mo mysql injection, you should use prepared statments either with PDO or mysqli, also mysql_* api are deprecated and soon will be no longer mantained.

php mysql query with hyphen character

I have a query problem with hyphen character.
$user = "test-user";
$q = #mysql_query("SELECT id FROM table WHERE user='$user'");
echo mysql_error(); //no error message
test-user record is in table but query result coming empty. Also mysql error message is empty. What is wrong?
EDIT:
Thank you for answers. I apologize to everyone. I found the problem and I see now the problem is not in the query. Problem coming form regex.
if (preg_match("/^[a-z0-9]+$/i", $user)) //dash character not in regex
{
$q = #mysql_query("SELECT id FROM table WHERE user='$user'");
}
I've corrected the problem as follows:
if (preg_match("/^[a-z0-9\-]+$/i", $user)) //added \- to regex for dash
{
$q = #mysql_query("SELECT id FROM table WHERE user='$user'");
}
Just use mysql_real_escape_string to escape the data string.
$user = "test-user";
$user = mysql_real_escape_string($user);
$q = #mysql_query("SELECT id FROM table WHERE user='$user'");
echo mysql_error(); //no error message
But I would also recommend using or die() syntax instead of the #mysql_query you have in place.
$user = "test-user";
$user = mysql_real_escape_string($user);
$q = mysql_query("SELECT id FROM table WHERE user='$user'") or die ("Error: " . mysql_error());
$p = mysql_query("SELECT id FROM table WHERE user='$user'");
if (!$p)
{
die('Could not query:' . mysql_error());
}
else
{
echo mysql_result($p>0);
}
try it
Try this:
$user = "test-user";
$q = mysql_query("SELECT id FROM `table` WHERE user='".$user."'")
or die(mysql_error());//no error message;
Full example with mysqli_:
$host = "";
$user = "";
$password = "";
$database = "";
$user_name_query = "test-user"; // If this value is from a form please read more about sql-injection.
// open connection to database
$link = mysqli_connect($host, $user, $password, $database);
IF (!$link){
echo ("Unable to connect to database!");
}
ELSE {
// SELECT QUERY
$query = "SELECT id FROM `table` WHERE user='".$user_name_query."'";
mysqli_query($link,$query) or die("Query failed");
}
// close connection to database
mysqli_close($link);
Any difference if you change the query to:
$q = mysql_query("SELECT id FROM table WHERE user='".$user."'");
Unless I'm having a very slow Sunday I think you're searching for the literal string $user rather than the variable value.

Selecting certain row in mysql

I am completely new to MYSQL and PHP, so i just need to do something very basic.
I need to select a password from accounts where username = $_POST['username']... i couldn't figure this one out, i keep getting resource id(2) instead of the desired password for the entered account. I need to pass that mysql through a mysql query function and save the returned value in the variable $realpassword. Thanks!
EDIT:
this code returned Resource id (2) instead of the real password
CODE:
<?php
$con = mysql_connect('server', 'user', 'pass');
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
echo '<br/> ';
// Create table
mysql_select_db("dbname", $con);
//Variables
//save the entered values
$enteredusername = $_POST['username'];
$hashedpassword = sha1($_POST['password']);
$sql = "SELECT password from accounts where username = '$enteredusername'";
$new = mysql_query($sql,$con);
echo "$new";
if (!mysql_query($sql,$con))
{
die('Error: ' . mysql_error());
}
mysql_close($con);
?>
It will be a lot better if you use PDO together with prepared statements.
This is how you connect to a MySQL server:
$db = new PDO('mysql:host=example.com;port=3306;dbname=your_database', $mysql_user, $mysql_pass);
And this is how you select rows properly (using bindParam):
$stmt = $db->prepare('SELECT password FROM accounts WHERE username = ?;');
$stmt->bindParam(1, $enteredusername);
$stmt->execute();
$result = $stmt->fetch(PDO::FETCH_ASSOC);
$password = $result['password'];
Also, binding parameters, instead of putting them immediately into query string, protects you from SQL injection (which in your case would be very likely as you do not filter input in any way).
I think your code looks something like this
$realpassword = mysql_query("SELECT password
from accounts where username = '$_POST[username]'");
echo $realpassword;
This will return a Resource which is used to point to the records in the database. What you then need to do is fetch the row where the resource is pointing. So, you do this (Note that I am going to use structural MySQLi instead of MySQL, because MySQL is deprecated now.)
$connection = mysqli_connect("localhost", "your_mysql_username",
"your_mysql_password", "your_mysql_database")
or die("There was an error");
foreach($_POST as $key=>$val) //this code will sanitize your inputs.
$_POST[$key] = mysqli_real_escape_string($connection, $val);
$result = mysqli_query($connection, "what_ever_my_query_is")
or die("There was an error");
//since you should only get one row here, I'm not going to loop over the result.
//However, if you are getting more than one rows, you might have to loop.
$dataRow = mysqli_fetch_array($result);
$realpassword = $dataRow['password'];
echo $realpassword;
So, this will take care of retrieving the password. But then you have more inherent problems. You are not sanitizing your inputs, and probably not even storing the hashed password in the database. If you are starting out in PHP and MySQL, you should really look into these things.
Edit : If you are only looking to create a login system, then you don't need to retrieve the password from the database. The query is pretty simple in that case.
$pass = sha1($_POST['Password']);
$selQ = "select * from accounts
where username = '$_POST[Username]'
and password = '$pass'";
$result = mysqli_query($connection, $selQ);
if(mysqli_num_rows($result) == 1) {
//log the user in
}
else {
//authentication failed
}
Logically speaking, the only way the user can log in is if the username and password both match. So, there will only be exactly 1 row for the username and password. That's exactly what we are checking here.
By seeing this question we can understand you are very very new to programming.So i requesting you to go thru this link http://php.net/manual/en/function.mysql-fetch-assoc.php
I am adding comment to each line below
$sql = "SELECT id as userid, fullname, userstatus
FROM sometable
WHERE userstatus = 1"; // This is query
$result = mysql_query($sql); // This is how to execute query
if (!$result) { //if the query is not successfully executed
echo "Could not successfully run query ($sql) from DB: " . mysql_error();
exit;
}
if (mysql_num_rows($result) == 0) { // if the query is successfully executed, check how many rows it returned
echo "No rows found, nothing to print so am exiting";
exit;
}
while ($row = mysql_fetch_assoc($result)) { //fetch the data from table as rows
echo $row["userid"]; //echoing each column
echo $row["fullname"];
echo $row["userstatus"];
}
hope it helps
try this
<?php
$con = mysql_connect('server', 'user', 'pass');
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
echo '<br/> ';
// Create table
mysql_select_db("dbname", $con);
//Variables
//save the entered values
$enteredusername = mysql_real_escape_string($_POST['username']);
$hashedpassword = sha1($_POST['password']);
$sql = "SELECT password from accounts where username = '$enteredusername'";
$new = mysql_query($sql,$con);
$row = mysql_fetch_array($new) ;
echo $row['password'];
if (!$new)
{
die('Error: ' . mysql_error());
}
mysql_close($con);
?>
<?php
$query = "SELECT password_field_name FROM UsersTableName WHERE username_field_name =".$_POST['username'];
$result = mysql_query($query);
$row = mysql_fetch_array($result);
echo $row['password_field_name'];
?>
$username = $_POST['username'];
$login_query = "SELECT password FROM users_info WHERE users_info.username ='$username'";
$password = mysql_result($result,0,'password');

Categories